# Generate signing keys

After setting up a signing worker, you may want to generate signing keys for use by tasks. (See also Configure an HSM for use with Debusine for high-value keys.)

This process currently requires administrative access to the server. In future it may be made available via a workflow or run automatically for new workspaces.

    $ sudo debusine-admin create_work_request signing generatekey --data - <<END
    purpose: uefi
    description: Some description of the new key
    END

This generates a new key and stores it as an asset. You can find the fingerprint of the new key by looking up the work request in the web interface.